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Report Summary 



Introduction 



Procurement cards (procards) are credit cards used by state 
employees, including university system staff, to purchase goods and 
services for official state business. In March 2004, the Office of 
Commissioner of Higher Education (OCHE) formed an 1 1 member 
independent panel to examine The University of Montana's (UM) 
Athletic Department deficit for fiscal year 2003-04. During its 
review, the panel identified management control weaknesses with the 
use of procards. In response to the panel's actions, OCHE submitted 
a written request to the Legislative Audit Committee to prioritize a 
performance audit of campus procard controls, which the Committee 
subsequently approved. 



Procards are Becoming 
more Prevalent on 
Montana Campuses 



Procards are becoming more prevalent on Montana campuses. In 
September 2001, the Legislative Audit Division issued a 
performance audit report of the State of Montana's purchasing card 
program (01P-03). At that time, there were approximately 730 total 
procards issued to employees on Montana's campuses. This 
compares to over 1,300 procards issued to campus employees as of 
October 2005. 



Campuses have Procard 
Controls in Place 



Campuses generally have procard controls in place and few issues 
were identified regarding how cardholders were using cards. 
Specific controls campuses have implemented include: 



Policies and procedures providing the basis to properly manage 
procard programs. 

Reviews of monthly procard activity including routine 
monitoring of management reports and reconciling receipts to 
monthly card statements. 

Purchases supported with receipts or other supporting 
documentation and procard managers generally following up 
with cardholders if receipts were not obtained. 

Cardholders receiving training on proper use of cards and 
signing cardholder agreements to use cards responsibly. 

Cardholders not splitting transactions to stay within purchasing 
limits or sharing procards with other individuals. 
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Controls Could Be 
Strengthened in Some 
Areas 



We noted campuses could strengthen certain portions of their 
procard policies and procedures to enhance existing controls. 



Clarifying Policies for Meal 
and Food Purchases 



We identified differences between written policies for meal and food 
purchases and how campuses interpreted these policies. Campus 
policies regarding food and meal purchases should be clarified. The 
Commissioner of Higher Education may want to direct campuses to 
re-evaluate restrictions on meal purchases and allow procards to be 
used for meal purchases when employees are in overnight travel 
status. 



Clarifying Appropriate 
Documentation for On- 
Going Procard Purchases 



It is common for on-going purchases, such as payment of monthly 
Internet fees, to be charged to procards. However, documentation 
did not always exist for these kinds of purchases. Campus officials 
stated they were unsure what level of documentation should be 
maintained for these purchases. Procard policies and procedures for 
campuses should be updated to clarify how on-going monthly 
charges should be documented. 



Defining Consequences for 
Inappropriate use of 
Procards 



Campus policies should have meaningful, well-defined consequences 
for employee misuse of procards. This includes consequences for 
not obtaining receipts, making personal purchases, or deliberate acts 
of fraud. Campus policies and cardholder agreements generally 
indicate failure to comply with policies and procedures may result in 
termination of procard privileges or other disciplinary action. 
However, they do not clearly define what constitutes inappropriate 
use of cards or the consequences if cards are not used appropriately. 
Campus policy should better define what constitutes inappropriate 
use and specific disciplinary actions to be taken if cards are not used 
appropriately. 



Developing Criteria for 
Establishing Card Limits 
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Since high card limits increase the risk of procard abuse, reasonable 
spending limits should be placed on procards to improve controls 
over purchasing activity. We noted 78 percent (204 of 260 sampled 
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cardholders) had monthly card limits between $20,000 to over 
$50,000. Some employees had monthly limits over $100,000. 
Campuses are generally using default card limits that are 
automatically assigned to cardholders when they are approved for a 
card. Instead, card limits should be commensurate with an 
employee's purchasing needs. Procard controls could be improved 
by developing criteria for assigning card limits, which include 
documentation supporting these decisions. 



Documenting Monthly Most procard managers follow similar procedures when reviewing 

Procard Manager Reviews monthly procard activity of cardholders. However, we noted several 

instances where follow-up with cardholders regarding missing 
receipts or other issues were not documented. In addition, procard 
managers were not always documenting their monthly reviews. 
Procard policies and procedures should be revised to require any 
follow-up with cardholders be documented. Policies should also 
require reviewing officials to date and sign monthly statements. 
These changes would help improve internal controls at each campus 
and provide assurance appropriate levels of managerial oversight 
exist. 



Page S-3 



Chapter I - Introduction 



Introduction 



In March 2004, the Office of Commissioner of Higher Education 
(OCHE) formed an 1 1 member independent panel to examine The 
University of Montana' s Athletic Department deficit for fiscal year 
2003-04. During its review, the panel identified management control 
weaknesses with the department's use of procurement cards 
(procards). Procards are credit cards issued to state employees, 
including university system staff, to use for purchases associated 
with official state business. 



Audit Objectives 



In response to the panel's actions, OCHE submitted a written request 
to the Legislative Audit Committee to prioritize a performance audit 
of campus procard controls. The Commissioner made this request 
"to provide the Regents, Legislators, and their concerned public a 
greater degree of confidence of the university system's stewardship 
of public funds." The Legislative Audit Committee approved 
OCHE's request and prioritized a performance audit of procard 
controls on Montana campuses. 

Audit objectives were directed at procard controls using sample 
items from all campuses. Our audit objectives were to determine if: 



Audit Scope 



1. Campuses have established formal controls over procards. 

2. Campuses are following established procard controls, including 
existing policies and procedures. 



Our audit assessed procard controls at the following campuses for 
fiscal year 2003-04: 



University of Montana (UM) 

UM -Missoula 

Missoula College of Technology 

Helena College of Technology 

Montana Tech 

Montana Tech College of Technology MSU-Northern 

UM-Western 



Montana State University (MSU) 

MSU-Bozeman 

Great Falls College of Technology 

MSU-Billings 

Billings College of Technology 
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UM's Internal Audit Helped 
Identify Risk Areas Related 
To Procard Controls 



Montana's community colleges are not using state procards and were 
not included in our audit scope. Appendix A provides further 
information regarding audit scope and methodologies used for 
evaluating campus procard controls. 

UM's internal audit unit examined the school's Athletic Department 
procard charges for a three-year time period. The internal audit 
findings helped us identify potential risk areas for the university 
system's procard controls. UM's internal audit identified control 
weaknesses such as missing receipts and procards used for personal 
purchases. The internal audit attributed these issues to a general lack 
of internal controls and managerial oversight of department procard 
use, including the roles and responsibilities of individuals reviewing 
procard transactions not being well-defined. The internal audit made 
several recommendations to the Athletic Department and university 
management to improve the department's procard controls. 



Potential Issue for 
Further Study - Inventory 
Control 



Transactions from UM's Athletic Department were not selected as 
part of our random sample during this audit. However, we 
interviewed officials from UM's Athletic Department regarding 
procard use. We also reviewed Athletic Department procard policies 
and reviewed a judgmental sample of procard transactions for fiscal 
year 2004-05. Based on this work, it appears the Athletic 
Department has improved controls over its procard program. 

We identified an issue outside the scope of our audit related to 
inventory control that could benefit from additional audit work. 
Presently, neither state policy nor campus procard or purchasing 
policies specifically require equipment costing less than $5,000 be 
tracked via an identity label, inventory system, or other means. 
However, state policy encourages agencies to track equipment under 
$5,000 that is "sensitive to theft." Over the last nine years, 249 items 
from within the university system were reported as stolen to the 
Legislative Audit Division. The total value of reported items is 
estimated at between $250,000 and $500,000 and includes 
computers, projectors, and television monitors. 
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While reviewing procard records, we noted inconsistencies between 
campuses and departments on larger campuses regarding whether 
equipment under $5,000 is tracked. Examples of equipment costing 
under $5,000 included laptop computers, personal digital assistants, 
and several other types of equipment. Even though state policy 
encourages agencies to track equipment with a value of less than 
$5,000 that is sensitive to theft, the policy does not define the type of 
equipment meeting this standard. Audit work could determine 
whether state policy should be better defined and if it would be cost 
efficient for the university system, and possibly other state agencies, 
to improve tracking procedures for equipment costing less than 
$5,000. 



Report Organization The remainder of this report is divided into three chapters. 

Chapter II provides information related to procard activity on 
Montana campuses. Chapter III provides conclusions regarding 
controls over procards. Chapter IV discusses recommended 
improvements to strengthen campus procard controls. 
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Introduction 



In 1996, the Department of Administration (DofA) entered into a 
contract with GE Capital Financial, Inc. to provide procurement card 
(procard) services to the State of Montana. The program permits 
state and university employees to be issued credit cards to make 
business-related purchases. The procard program was developed to 
more effectively manage low dollar purchases such as office 
supplies, computer equipment, lodging expenses, and airfare. This is 
done by: 



► Reducing paperwork for small purchases. 

► Enhancing reporting and monitoring of purchases. 

► Eliminating multiple warrants issued to the same vendor. 

► Allowing for more timely payments to vendors. 

► Simplifying employee purchases while working in the field or 
during emergencies. 



University System 
Organization 



DofA renewed the contract with GE Capital Financial, Inc., until 
contract renewal options expired in 2004. After issuing a Request 
for Proposal, DofA signed a three-year contract in March 2005 with 
U.S. Bank to provide procard services. According to DofA officials, 
U.S. Bank officially took over contract duties in August 2005. The 
past and current contract gives DofA responsibility to administer the 
statewide purchasing card program. However, DofA delegates 
authority to the Montana Department of Transportation (MDT), The 
University of Montana (UM), and Montana State University (MSU) 
to administer their own procard programs. This includes establishing 
procard policy, issuing cards to employees, and tracking purchases 
made by cardholders. These agencies must administer their procard 
programs within DofA guidelines. 

The Montana Board of Regents (the Board) has constitutional and 
statutory responsibility and authority to supervise, coordinate, and 
manage Montana's university system. The Office of Commissioner 
of Higher Education communicates and implements the policies and 
directives of the Board to the campuses. The following figure 
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illustrates the organizational structure of Montana's university 
system. 



Figure 1 
Organization of Montana's University System 
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Source: Compiled by the Legislative Audit Division from Office of Commissioner of 
Higher Education information. 



Campuses Are Responsible 
for Procard Activity 



Each campus is responsible for monitoring its own procard activity. 
This includes approving employees to receive procards, training 
cardholders on proper use of procards, and reviewing procard 
transactions. Campuses assign procard responsibilities to individuals 
who perform these duties as part of their overall job responsibilities. 
The following sections briefly describe the process for monitoring 
procard activity at each campus. 



Montana State University 
and Affiliated Campuses 



The Controller's Office at Montana State University-Bozeman 
(MSU) is responsible for approving employees to receive procards, 
training cardholders on using cards, and conducting monthly reviews 
of procard transactions for all departments on the MSU campus. 
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University of Montana and 
Affiliated Campuses 



Computer Software 
Tracks Procard Activity 



Prior to submitting information to the Controller's Office, accounting 
technicians within each MSU department compile and review 
procard documentation on a monthly basis. MSU's Internal Audit 
Unit conducts monthly audits of department procard activity to 
verify compliance with campus policies and procedures. MSU's 
affiliated campuses are responsible for monitoring their own procard 
activity. Depending on the campus, this may be done by the 
Business Office, the Controller's Office, or procard managers within 
individual departments. 

The Business Services Office at The University of Montana- 
Missoula (UM) is responsible for approving employees who receive 
procards and training employees on the proper use of cards. 
Business Services also performs annual audits of department and 
affiliated campus procard activity. Each department on UM's 
campus has a procard manager responsible for reviewing monthly 
procard activity of department cardholders and following up on any 
concerns. UM's affiliated campuses are responsible for monitoring 
their own procard activity. Depending on the campus, this may be 
done by the Business Office, the Controller's Office, or procard 
managers within individual departments. 

As part of its former contract, GE Capital Financial, Inc., provided 
the state with procard activity reporting software. The Purchasing 
Accounting Reporting Information System (PARIS) record procard 
activity using several data fields, such as purchase amount, date, and 
vendor. PARIS allows for daily update and review of information, 
which is generally available within 48 hours after purchases are 
made. PARIS generates a number of reports that assist procard 
managers in evaluating procard activity such as items purchased by 
cardholders, the number of purchases made, dollars expended by 
cardholders, vendors where purchases were made. UM and MSU 
campuses each use PARIS to track procard activity. Similar 
computer software will also be provided by U.S. Bank. 
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Procards are Becoming 
More Prevalent on 
Montana Campuses 



Procard Purchases are 
Increasing 



Procards are becoming more prevalent on Montana campuses. In 
September 2001, the Legislative Audit Division issued a 
performance audit report of the State of Montana' s purchasing card 
program (01P-03). At that time, there were approximately 730 
procards issued to university employees. This compares to over 
1,300 procards currently issued to campus employees. Table 1 
provides information on the approximate number of cardholders at 
each campus during fiscal year 2003-04. 





Table 1 
Approximate Number of Campus Cardholders 




FY 2003-04 








Montana State University Campuses 




MSU-Billings and College of Technology 


94 


MSU-Northern 


33 


MSU-Great Falls College of Technology 


24 


MSU-Bozeman 


447 


MSU TOTAL 


598 












University of Montana Campuses 




UM-Missoula and College of Technology 


610 


UM-Tech and College of Technology 


88 


UM-Western 


31 


UM-Helena College of Technology 


19 


UM TOTAL 


748 


Sou 


rce: Compiled by the Legislative Audit Div 
PARIS records provided by UM and 1 
Internal Audit. 


isior 
VIST 


lfrom 

I 



Over the last three years, campus procard purchases increased more 
than 36 percent, increasing from $14.3 million in 2002 to 
approximately $19.6 million in 2004. The following table shows 
total procard purchases for UM, MSU, and their affiliated campuses 
for each of the last three years. 
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Table 2 

Total Procard Purchases for UM and MSU Campuses 
Contract Years 2002 through 2004 





2002* 


2003* 


2004* 


Campus** 








UM 


$9,144,271 


$9,809,180 


$10,983,410 


MSU 


$5,188,473 


$7,127,759 


$8,581,996 


Total 


$14,332,744 


$16,936,939 


$19,565,406 



* Contract year is September-August 
** Includes affiliated campuses 



Source: Compiled by the Legislative Audit Division from DofA information. 



Rebate Programs Encourage 
Procard Use 



The State of Montana's procard contract incorporates a rebate 
program as incentive to use procards when making purchases. The 
rebate program encourages procard use because higher dollar 
volumes of purchases result in higher rebates to the state. The state 
also receives rebates for timely payments. 



Campuses Receive Rebates 



The majority of rebates the state receives are based on net 
annual procard purchases with a smaller portion based on 
timely payments to vendors. State agencies will receive 
larger rebates under the new contract with U.S. Bank. For 
example, if a state agency has $10 million in net purchases, 
U.S. Bank will pay a rebate of .8760 percent rather than a 
.10 percent rebate offered in the previous contract. 
According to DofA officials, the larger rebates were an 
important factor in U.S. Bank being awarded the contract. 

Rebates are distributed to campuses based on their percentage of 
total card use. For example, in contract year 2004, campuses 
accounted for 61.57 percent of the state's procard purchasing volume 
and received $51,754.21 in rebated funds. These funds assist 
campuses in administration of their procard programs. 
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Summary The state's procard program was created to more effectively manage 

small purchases made by state agencies, including Montana's 
campuses. Various incentive programs and higher numbers of 
procards issued to campus employees has led to continued increases 
in procard purchases over the last several years. Indications are 
procard use will continue to grow. With procard use becoming more 
common, it is important management control systems exist to ensure 
the integrity of procard programs on the state's campuses. The next 
chapter discusses our assessment of campus procard controls. 
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Introduction 



This chapter discusses existing management controls on Montana's 
campuses, and addresses our audit objectives. Our objectives were 
to determine if: 

► Campuses have established formal controls over procards. 

► Campuses are following established procard controls, including 
existing policies and procedures. 



Overall Conclusion : 

Campuses have procard controls in place and few issues were 
identified during audit fieldwork. Campuses could strengthen 
portions of their procard policies and procedures to enhance 
existing controls. 



The remainder of this chapter discusses existing controls. The 
following chapter provides a recommendation on how these controls 
could be enhanced. 



What Controls Should 
Exist Over Procards? 



The Institute of Internal Auditors (IIA) is an international 
professional association that provides standards and technical 
guidance to the internal auditing profession. According to the IIA, 
even procard programs with well-designed controls cannot be 
assured of being problem-free. Therefore, while good controls can 
help reduce the number of problems, controls do not always prevent 
problems from occurring. However, a control system incorporating 
sufficient checks and balances reduces the number of occurring 
problems, and just as importantly, identifies problems early so they 
can be resolved in a timely manner. 



We contacted a variety of sources to determine what constitutes 
appropriate levels of controls over procards. Information was 
obtained from the IIA, the banking industry, other state procard 
programs, and interviews with campus procard administrators and 
managers. Based on information obtained from these sources, 
several different controls should exist over procards. These include: 

1. Policies and procedures defining card issuance and use. 
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2. Reviews of procard transactions by someone other than 
cardholders. 

3. Purchases supported with receipts or other documentation. 

4. Cardholder training on procard use and cardholder agreements. 

5. Reasonable card limits based on a cardholder's purchasing 
needs. 

The following sections describe how campuses have implemented 
each of these controls. 



Campuses Have 
Established Procard 
Policies and Procedures 



All campuses follow policies and procedures for procard issuance 
and use. Policies and procedures outline card approval/issuance, 
training requirements for new cardholders, responsibilities of 
cardholders, prohibited uses of cards, and the process for monitoring 
card usage. The following provides examples of general policy 
requirements/controls : 



► Card issuance - Employees must complete an application to 
receive a card. The employee's supervisor and/or department 
head must approve the need for the card and sign the application. 
The application is forwarded to the campus procard 
administrator for additional approval. Prior to receiving a 
procard, employees receive training on policies and procedures, 
card use, record-keeping requirements, etc. from the campus 
procard administrator. Once training is completed, employees 
sign a cardholder agreement signifying they understand all 
procard policies and will only use the procard for business- 
related purposes. 

► Responsibilities of cardholders - Policies outline the 
responsibilities of cardholders to ensure proper use of the 
procard. Responsibilities include obtaining documentation of all 
purchases, only using cards for allowable expenses, complying 
with other campus purchasing and expenditure guidelines, not 
sharing procards with other individuals, and not splitting 
purchases into multiple transactions to stay within approved 
purchasing limits. 

► Documentation requirements - Purchases must be supported with 
itemized receipts describing the goods or services purchased 
with procards. Acceptable documentation includes cash register 
receipts, shipping invoices, or information from Internet 
websites if purchases are made on-line. Receipts are a basic 
control providing evidence procards were used for appropriate 
purposes. 
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► Monitoring procard use - Policies require card transactions be 
monitored to ensure they comply with campus policies. 
Campuses have designated at least one person with responsibility 
to review purchase documentation and follow-up on any 
questions regarding purchases. Some campuses use a centralized 
system where documentation is submitted to one place and for 
review, such as the campus Business Office. Other campuses 
use a decentralized system where an authorized person within 
individual departments reviews procard documentation. 
Campuses with high levels of procard use, such as UM and 
MSU, also conduct audits of department procard activity to 
ensure purchases and documentation comply with policy. 



Policies Prohibit Certain 
Items From Being 
Purchased with Procards 



Even though procards can be used to purchase most low cost items, 
state and campus policies prohibit the purchase of certain items to 
help protect the integrity of the procard program. For example, state 
procard policies do not allow procards to be used for personal 
expenses, cash advances, or meals during day trips away from the 
office. Campus policies and procedures generally have similar 
requirements as state policy, but with some added restrictions. For 
example, even though state policy allows cards to be used to 
purchase meals for overnight travel, campuses generally do not allow 
procards to be used for meals when employees are traveling. The 
one exception on most campuses is the Athletic Department, where 
personnel are often authorized to use procards for team meals or to 
purchase meals when recruiting student athletes to help reduce the 
amount of cash coaches must carry. 



Conclusion : 

Campuses have established procard policies and procedures 

providing the basis for properly managing their procard 

programs. 



Reviews of Procard 
Activity 



Monitoring procard use through on-going reviews of purchases is 
generally considered the most important control over procards. 
These reviews verify policies and procedures are followed and 
purchases are appropriate. Reviews of procard activity also provide 
a level of oversight to help identify and address potential issues. 
Management reports are generated providing data to campus procard 
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managers such as items cardholders purchased, the number of 
purchases made, and dollars expended. Campus procard managers 
monitor this information on a routine basis. 



Procard managers are conducting independent reviews of procard 
activity. These reviews include routine monitoring of management 
reports and reconciling receipts to monthly procard statements. In 
addition, procard managers generally have authority to question 
purchases or address problems with cardholders. In some cases, 
limited staff resulted in someone subordinate to cardholders 
conducting reviews. In these cases, however, individuals can discuss 
questionable purchases with management, such as department heads 
or controllers. In addition, campuses such as UM and MSU, conduct 
procard audits which provide an additional compensating control 
over procard activity. 



Conclusion : 

Campus procard managers are conducting on-going reviews of 
procard activity. These reviews include routine monitoring of 
management reports and reconciling receipts to monthly 
statements. Campuses are also conducting audits of 
department procard activity. 



Purchases are Generally 
Supported With Receipts 
or Other Documentation 



For the campuses visited, we reviewed 2,453 procard purchases 
totaling more than $543,000. We found 95 percent of all items 
purchased with procards were supported with receipts or other 
supporting documentation. In addition, we noted most purchases 
made with procards were items allowed by policy. We did not find 
any items of significance that were purchased and not supported with 
receipts or other documentation. Examples of items not 
appropriately documented included napkins, light bulbs, Internet 
service, conference registrations, and miscellaneous food items. 



Officials overseeing procard programs at campuses said there were 
several reasons why receipts were missing. In some cases, 
cardholders forgot to obtain a receipt or misplaced the receipt before 
it was turned in. In other cases, campus officials said receipts were 
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maintained somewhere other than in the procard file. In many cases, 
alternative documentation was found in procard files indicating why 
receipts were missing and efforts made to obtain documentation 
related to purchases. For example, we found e-mails between 
reviewing officials and cardholders discussing why receipts were 
missing and efforts made to obtain duplicate receipts. In addition, 
procard files often included documentation noting the reason items 
were purchased and evidence the purchases were approved. 



Conclusion : 

Ninety-five percent of procard purchases reviewed were 
supported with receipts or other documentation. For purchases 
without receipts, campuses generally followed up with 
cardholders to obtain receipts or document reasons why receipts 
were not obtained. 



Training Is Provided to 
Cardholders and 
Cardholder Agreements 
are Signed 



Campus procard administrators and cardholders indicated training is 
provided prior to issuing procards. Training helps ensure 
cardholders are aware of campus expectations and cardholder 
responsibilities for appropriate card use. Training sessions generally 
cover campus policies and procedures for card use, what constitutes 
allowable and non-allowable purchases, and proper documentation 
for purchases. Once training is completed, cardholders sign a 
cardholder agreement indicating they agree to comply with all 
procard policies and use the card responsibly. 



Conclusion : 

Cardholders receive training from campus administrators on 
proper use of procards and sign cardholder agreements to use 
procards responsibly. 



No Instances of Splitting 
Transactions Were 
Identified 



Procard policies clearly state cardholders are not to split purchases 
into multiple transactions to stay within approved purchasing limits. 
For example, if a cardholder is authorized to spend up to $5,000 on a 
single transaction, they cannot spend $9,000 by splitting the 
transaction into two purchases. Audit work did not identify evidence 
of cardholders splitting transactions to stay within their purchasing 
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limits. Most cardholders generally use procards for small dollar 
purchases. However, approved card limits for most cardholders are 
generally high enough to eliminate need to split transactions to stay 
within established limits. 



Cardholders Are Not 
Sharing Procards 



Based on the transactions reviewed, we did not identify evidence of 
cardholders sharing cards with other individuals. In some cases it 
was not always possible to determine who made a purchase, 
particularly if a purchase was made on the Internet or over the phone. 
However, the majority of purchases we reviewed were made in 
person and the individual issued the card was the name on the 
receipt. 



Conclusion 

Cardholders are not splitting purchasing transactions to stay 
within purchasing limits and there was no evidence of 
cardholders sharing procards. 
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Introduction 



Clarifying Policies for 
Meal and Food Purchases 



As discussed in the previous chapter, campuses have established 
procard controls and are generally following these controls. 
However, we identified areas where current controls could be 
strengthened. This chapter makes recommendations to enhance 
certain components of procard policies. Areas where we recommend 
improvements include: 

► Clarifying card use for meals and other food purchases. 

► Clarifying appropriate documentation for on-going purchases. 

► More clearly defining consequences for inappropriate use of 
procards. 

► Developing criteria for card limits issued to cardholders. 

► Improving documentation of reviews of procard activity. 

The following sections discuss each of these areas in further detail. 

We identified differences between written policies for meal and food 
purchases and how campus officials interpreted these policies. For 
example, on most campuses we identified cardholders charging 
meals and/or food for departmental meetings to their procards. Some 
campus policies state "meals" may not be charged to cards and 
policies at other campuses indicate "food" cannot be purchased. 
Campus officials stated meals should generally not be charged to 
procards although some exceptions are made for athletic departments 
or university officials entertaining someone while conducting 
university business. Officials from those campuses charging food 
items for meeting refreshments indicated policy restrictions do not 
apply to these kinds of food purchases. 



Policies regarding food and meal purchases at campuses should be 
clarified to specifically state what kinds of food or meal purchases 
are allowable and who may use procards for these purchases. State 
policy allows procards to be used for meal purchases and several 
state agencies use them for this purpose. To help reduce confusion 
on when food and/or meals may be purchased, the Commissioner of 
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Clarifying Appropriate 
Documentation for On- 
Going Procard Purchases 



Defining Consequences 
for Inappropriate Use of 
Procards 



Higher Education may want to direct campuses to re-evaluate 
restrictions on meal purchases and allow cardholders to use cards to 
purchase meals when in overnight travel status. 

It is common for on-going procard purchases, such as monthly 
Internet fees, to be charged to procards. However, documentation 
did not always exist for these kinds of purchases at several 
campuses. For example, approximately 50 percent of procard 
charges we identified without receipts or other documentation on one 
campus were for monthly Internet charges. Campus officials stated 
they were unsure what level of documentation should be maintained 
for these kinds of purchases. Since these were on-going monthly 
charges approved by cardholders, campus officials did not believe 
there was a need to document the charge every month. However, 
appropriate levels of procard controls suggest documentation exist 
for these purchases to verify the charges are authorized by 
cardholders and supervisors. Documentation could include monthly 
billing statements from vendors attached to monthly procard 
statements or one-time supporting documentation indicating the 
monthly charge is authorized, the name of the vendor, and purpose of 
the charge. Procard policies and procedures for each campus should 
be updated to clarify how on-going monthly charges should be 
documented. 

According to the Institute of Internal Auditors, purchases should 
"never be approved without detailed supporting documentation that 
delineates the entire amount charged." The Institute also suggests 
policies have meaningful, well-defined consequences for misuse of 
cards. This includes consequences for not obtaining itemized 
receipts, making personal purchases (accidental or otherwise), or 
deliberate acts of fraud. 



Neither policy nor cardholder agreements for campuses clearly 
define what constitutes card misuse nor the consequences for misuse. 
These documents generally indicate failure to comply with policies 
and procedures may result in termination of procard privileges or 
other disciplinary action. However, the documents do not 
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specifically define what "failure to comply" means or exactly what 
will happen if cardholders do not comply with policies. For 
example, does failure to submit one itemized receipt or one personal 
use of a procard constitute card misuse? Some campus officials 
indicated lack of a clearly defined policy has hindered their ability to 
take disciplinary action because employees challenge them to 
specifically point out where policies describe what should be done. 
To help make consequences of inappropriate procard use more 
significant and enforceable, campuses should better define what 
constitutes inappropriate use and the specific actions to be taken if 
procards are not used appropriately. Some campuses, such as The 
University of Montana (UM), stated they have already started to 
make these changes. 



Developing Criteria for Spending limits are placed on procards to help control purchasing 

Establishing Card Limits activity. Campuses are generally using default card limits 

automatically assigned to cards when employees are approved. For 
example, during our audit period, UM campuses had default card 
limits of $5,000 per transaction and $20,000 per month (billing 
cycle). Montana State University campuses had card limits of 
$5,000 per transaction and $50,000 per month. Employees can be 
approved for higher or lower limits if deemed necessary. 

According to the Institute of Internal Auditors, employees should not 
be issued "blanket limits" (i.e. default limits) for cards because 
higher card limits increase the risk of procard abuse by providing 
more purchasing capabilities. Instead, card limits should be 
commensurate with purchasing needs and should slightly exceed the 
highest actual purchase by a cardholder in the preceding year. Based 
on our sample, 78 percent (204 of 260 sampled cardholders) of 
cardholders reviewed in our sample had monthly card limits from 
$20,000 to more than $50,000. Some cardholders had monthly card 
limits over $100,000. Even though most cardholders are issued 
campus default limits, these limits may still be higher than necessary. 
Procard limits should be commensurate with an employee's job 
duties and purchasing needs. 
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We found no evidence cardholders were abusing or attempting to 
abuse high card limits. However, card limits higher than what 
employees need increases the risk abuse could occur. Furthermore, 
interviews with campus officials indicated there are risks associated 
from sources outside the campus. Specifically, officials from several 
campuses indicated there have been instances where card numbers 
were stolen over the Internet and attempts made to make purchases. 
Higher than necessary card limits increase the risk to outside fraud. 

Campus policies generally place responsibility for setting card limits 
with employee supervisors, department heads, and campus procard 
administrators. However, policies do not outline clear criteria to 
determine what card limits should be assigned to employees or that 
these reasons be documented. Developing this criteria and 
documenting the reasons card limits are assigned to employees could 
improve procard controls. 



Documenting Monthly Most campus procard managers followed similar procedures when 

Procard Manager Reviews reviewing monthly statements. However, differences existed in how 

or if follow-up to potential problems were documented. For 
example, in several cases where receipts were missing, we found file 
documentation indicating procard managers contacted the 
cardholder. This information provided an explanation on why the 
problems occurred and how they were resolved. However, we also 
noted cases where there was no evidence procard managers followed 
up on problems. Subsequent interviews with procard managers 
indicated they conducted follow-up with cardholders, but did not 
know they should be documenting this effort. 

We identified similar issues with reviews of monthly procard 
statements. In many cases, reviewers were signing the monthly 
statement and dating the review. Therefore, there was evidence of 
timely procard reviews by appropriate personnel. However, we 
identified several examples on campuses where individuals 
conducting reviews and dates of reviews were not documented. In 
these instances, it was not possible to determine if someone other 
than the cardholder conducted monthly reviews or if reviews were 
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done in a timely manner. Follow-up interviews with procard 
managers determined they conducted the reviews, but did not know 
they should document their reviews by signing and dating the 
monthly statement. 



Summary: Campuses 
Have Procard Controls in 
Place and Policy 
Enhancements Could 
Improve Controls 



According to campus procard managers, procard policies and 
procedures only require procard activity be reviewed. Policies and 
procedures do not discuss how follow-up with cardholders or 
monthly reviews of procard activity should be documented. Campus 
policies and procedures should be revised to require individuals 
reviewing monthly statements to sign and date the statements at 
review completion. In addition, policies should require all follow-up 
with cardholders be documented. These changes would help 
improve internal controls at each campus and provide assurance 
appropriate levels of managerial oversight exist. 

The number of procards issued to campus employees and the number 
of purchases made on procards is increasing and expectations are for 
these trends to continue. Campuses have established procard 
controls, including policies and procedures, receipts documenting 
purchases, and on-going reviews of procard activity. In most cases, 
campuses are following established controls and cardholders are 
generally using cards responsibly. Additionally, our review did not 
identify any instances of fraud related to procard purchases. 



While basic controls are in place, we identified areas where procard 
controls could be enhanced. In general, these enhancements relate to 
policy clarifications to help ensure campuses have stronger controls 
as more procards are issued to employees and procard purchases 
continue to increase. Improving existing controls will also help 
minimize potential losses due to card misuse. 
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Recommendation #1 



We recommend the Office of Commissioner of Higher 
Education direct campuses to clarify procard policies and 
procedures to: 

A. Clarify meal and food purchases and assess the potential 
for allowing procards to be used for meals when employees 
are in overnight travel status. 

B. Clarify what constitutes appropriate documentation for on- 
going monthly purchases. 

C. Better define consequences for inappropriate use of 
procards or not complying with campus procard policies. 

D. Develop criteria for establishing card limits and document 
why employees are issued the card limits they are provided. 

E. Assure more consistency in documenting monthly reviews 
of procard activities such as signing and dating monthly 
reviews and documenting follow-up with cardholders. 
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Audit Methodology 



Preliminary audit work was conducted to gain an understanding of 
campus procard systems and controls. We interviewed the State 
Procard Program Manager at the Department of Administration and 
the Director of Budgeting and Accounting at the Office of 
Commissioner of Higher Education. We also reviewed Montana 
purchasing laws and rules and examined the Montana Operations 
Manual related to the state's procard program. 



We interviewed officials from the internal audit units at Montana 
State University- Bozeman (MSU) and The University of Montana- 
Missoula (UM) regarding internal audits completed on procards and 
procard controls. We also interviewed procard administrators and 
procard managers within academic departments on individual 
campuses. We conducted preliminary file reviews at campuses to 
determine the types of documentation maintained for procard 
purchases. We obtained procard policies and procedures for all 
campuses. 



Audit Sample 



We examined performance audit reports previously issued by the 
Legislative Audit Division related to procards. Reports reviewed 
included Purchasing Card Program (01P-03) and Management of 
State Government Airfare Purchases (03P-07). We examined the 
findings from the Special Panel that reviewed the UM Athletic 
Department deficit and UM's Internal Audit report of the Athletic 
Department's use of procards. We also reviewed audit reports issued 
by other states related to procards. 

After completing preliminary audit work, we determined fieldwork 
should focus on file reviews at each campus. To assist in 
establishing our population and statistical sample, we requested 
procard transaction information for fiscal year 2003-04 from MSU 
and UM internal auditors. Once data was received it was sorted by 
campus and index (accounting) codes. This allowed us to obtain the 
total number of transactions and total level of activity for each 
campus. 
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We developed a stratified sample of index codes based on the 
amount of procard activity within each code. Our sample was 
divided into three groups to assess controls for different levels of 
procard activity. We used stop and go sampling and a 5 percent 
error rate and a 90 percent confidence rate for our procard review. A 
total of 2,453 procard purchases made by 260 different cardholders 
were reviewed. 



File Review 



Criteria 



Data obtained from each campus was used to assist audit staff in 
reviewing and documenting campus procard activity. Follow-up 
interviews were conducted with campus officials to discuss questions 
identified during file reviews or to clarify questions we had 
regarding procard policies and procedures. 

We obtained criteria for this audit from several different sources. 
Criteria used to evaluate campus procard controls included: 



► State purchasing laws. 

► Campus procard policies and procedures. 

► Contracts between GE Capital and Department of 
Administration. 

► Policies and procedures at universities in other states. 

► Banking industry information. 

► Information from the Institute of Internal Auditors. 
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RECEIVED 

OCT 2 2005 
LEGISLATIVE AUDIT DIV. 



MONTANA UNIVERSITY SYSTEM 
OFFICE OF THE COMMISSIONER OF HIGHER EDUCATION 



46 N LAST CHANCE GULCH PO BOX 203201 HELENA, MONTANA 59620-3201 (406) 444-6570 FAX (406) 444-1469 



October 21, 2005 



Mr. Jim Pellegrini 
Legislative Audit Division 
Room 160, State Capitol 
PO Box 201705 
Helena, MT 59620-1705 

Dear Mr. Pellegrini: 

I would like to thank the Legislative Audit Committee for authorizing this performance audit of 
management controls over procurement card use in the Montana University System. The 
Legislative Audit staff conducted their work with professionalism and courtesy. We concur with the 
audit recommendation to clarify certain procard policies and procedures. 

The Office of the Commissioner of Higher Education will be meeting with the Montana University 
System Controllers in December 2005 to begin the implementation of the audit recommendation. 

Thank you again for your assistance. 




Dr. Sheila Stearns 

Commissioner of Higher Education 
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MONTANA STATE UNIVERSITY - Campuses at Billings, Bozeman, Great Falls, and Havre 

THE UNIVERSITY OF MONTANA - Campuses at Butte, Dillon, Helena, and Missoula 

Dawson Community College (Glendive) - Flathead Valley Community College (Kalispell) - Miles Community College (Miles City) 



